Fix CodeQL warnings on CI

Author: webstackdev

.github/copilot-instructions.md

@@ -45,6 +45,12 @@ You are working in Newsletter Maker, a Django + DRF + Celery + Qdrant backend wi
 - TypeScript and React code should use JSDoc for exported utilities, hooks, route handlers, and non-trivial components when behavior is not obvious from the type signature alone.
 - If architecture or workflow behavior changes, update the most relevant docs in `docs/`, especially `docs/DEVELOPER_GUIDE.md`, `docs/IMPLEMENTATION_OVERVIEW.md`, `docs/MODELS.md`, `docs/RELEVANCE_SCORING.md`, or `docs/LOGGING.md`.
 
+## Prompt Skill Conventions
+
+- Application prompt skills live under `skills/<skill_name>/SKILL.md` and are loaded by `core/llm.py` using the folder name rather than the frontmatter `name`.
+- When adding or editing one of these prompt skills, always include a short frontmatter `description` so VS Code does not report incomplete skill metadata.
+- If a frontmatter `name` is present, prefer lowercase letters, numbers, and hyphens there to satisfy the Copilot markdown validator, even when the runtime skill key elsewhere in the app still uses underscores.
+
 ## Testing And Validation
 
 - Backend tests use `pytest`.

.github/instructions/prompt-skills.instructions.md

@@ -0,0 +1,15 @@
+---
+name: "Prompt Skill Markdown Guidelines"
+description: "Use when editing application prompt skills in skills/**/SKILL.md. Covers custom frontmatter, runtime lookup behavior, and keeping VS Code's skill validator quiet."
+applyTo:
+  - "skills/**/SKILL.md"
+---
+
+# Prompt Skill Markdown Guidelines
+
+- Files under `skills/**/SKILL.md` are application prompt specs loaded by `core/llm.py`, not Copilot repo skills under `.github/skills/`.
+- The runtime skill key is the folder name, so keep folder names and code constants aligned with the app's expected key.
+- Always include a short frontmatter `description` to avoid VS Code skill-schema warnings.
+- If a frontmatter `name` is present, prefer lowercase letters, numbers, and hyphens so the Copilot validator stays quiet, even when the runtime key elsewhere in the app uses underscores.
+- Preserve the repo's `input` and `output` frontmatter fields because `core/llm.py` reads them to build prompts.
+- Keep the body concise and instruction-focused. Return-shape requirements should stay explicit in the markdown body.

core/permissions.py

@@ -13,9 +13,11 @@
     class PermissionBase:
         """Typed shim for DRF permissions whose default methods return bool."""
 
-        def has_permission(self, request, view) -> bool: ...
+        def has_permission(self, request, view) -> bool:
+            pass
 
-        def has_object_permission(self, request, view, obj) -> bool: ...
+        def has_object_permission(self, request, view, obj) -> bool:
+            pass
 
 else:
     PermissionBase = permissions.BasePermission

newsletters/intake.py

@@ -24,9 +24,11 @@
 class QueuedTask(Protocol):
     """Protocol for Celery tasks used by newsletter intake dispatch."""
 
-    def apply(self, *args: object, **kwargs: object) -> object: ...
+    def apply(self, *args: object, **kwargs: object) -> object:
+        pass
 
-    def delay(self, *args: object, **kwargs: object) -> object: ...
+    def delay(self, *args: object, **kwargs: object) -> object:
+        pass
 
 
 def _require_pk(instance: Model) -> int:

newsletters/tasks.py

@@ -15,7 +15,8 @@
 class DelayedTask(Protocol):
     """Protocol for Celery tasks dispatched through ``delay``."""
 
-    def delay(self, *args: object, **kwargs: object) -> object: ...
+    def delay(self, *args: object, **kwargs: object) -> object:
+        pass
 
 
 def _enqueue_task(task: object, *args: object) -> None:

projects/api.py

@@ -4,7 +4,6 @@
 
 from django.conf import settings
 from django.core.mail import send_mail
-from django.db.models import QuerySet
 from django.utils import timezone
 from drf_spectacular.utils import OpenApiResponse, extend_schema, inline_serializer
 from rest_framework import mixins, serializers, status, viewsets

trends/api.py

@@ -233,7 +233,9 @@ def accept(self, request, *args, **kwargs):
         try:
             accept_theme_suggestion(suggestion, user_id=request.user.id)
         except ValueError as exc:
-            raise serializers.ValidationError({"status": str(exc)}) from exc
+            raise serializers.ValidationError(
+                {"status": "Unable to accept this theme suggestion."}
+            ) from exc
         suggestion = self.get_queryset().get(pk=suggestion.pk)
         serializer = self.get_serializer(suggestion)
         return Response(serializer.data)
@@ -266,7 +268,9 @@ def dismiss(self, request, *args, **kwargs):
                 reason=serializer.validated_data["reason"],
             )
         except ValueError as exc:
-            raise serializers.ValidationError({"status": str(exc)}) from exc
+            raise serializers.ValidationError(
+                {"status": "Unable to dismiss this theme suggestion."}
+            ) from exc
         response_serializer = self.get_serializer(suggestion)
         return Response(response_serializer.data)
 

users/api.py

@@ -26,7 +26,8 @@
 class DelayedTask(Protocol):
     """Protocol for Celery tasks dispatched through ``delay``."""
 
-    def delay(self, *args: object, **kwargs: object) -> object: ...
+    def delay(self, *args: object, **kwargs: object) -> object:
+        pass
 
 
 def _enqueue_task(task: object, *args: object) -> None: